Openmanage Enterprise
Monthly
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released version 4.7.0 as the remediated release per advisory DSA-2026-359.
Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a monitor-and-patch rather than emergency-response category.
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
Path traversal in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote low-privileged attacker to read files outside the intended directory scope, resulting in information exposure. The vulnerability is classified under CWE-22 and carries a CVSS 3.1 base score of 6.5 (Medium), with high confidentiality impact and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker to inject malicious SQL constructs via the platform's web interface, leading to script injection and potential full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity and no user interaction required beyond valid credentials. No public exploit has been identified at time of analysis, and EPSS places current exploitation probability at 0.29% (21st percentile), though SSVC rates the technical impact as total.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege credentials to manipulate backend database queries, with the vendor noting this can cascade into script injection within the management interface. The CVSS vector rates impact as high across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and Dell has released a fix in version 4.7.0 per advisory DSA-2026-359.
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to execute arbitrary operating system commands on the underlying server. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is network-exploitable with low complexity, requiring only a low-privilege account - a minimal barrier in enterprise environments where many users hold valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a patch in version 4.7.0 per advisory DSA-2026-359.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a remote code execution vulnerability. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released version 4.7.0 as the remediated release per advisory DSA-2026-359.
Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a monitor-and-patch rather than emergency-response category.
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
Path traversal in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote low-privileged attacker to read files outside the intended directory scope, resulting in information exposure. The vulnerability is classified under CWE-22 and carries a CVSS 3.1 base score of 6.5 (Medium), with high confidentiality impact and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker to inject malicious SQL constructs via the platform's web interface, leading to script injection and potential full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity and no user interaction required beyond valid credentials. No public exploit has been identified at time of analysis, and EPSS places current exploitation probability at 0.29% (21st percentile), though SSVC rates the technical impact as total.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege credentials to manipulate backend database queries, with the vendor noting this can cascade into script injection within the management interface. The CVSS vector rates impact as high across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and Dell has released a fix in version 4.7.0 per advisory DSA-2026-359.
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to execute arbitrary operating system commands on the underlying server. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is network-exploitable with low complexity, requiring only a low-privilege account - a minimal barrier in enterprise environments where many users hold valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a patch in version 4.7.0 per advisory DSA-2026-359.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a remote code execution vulnerability. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.